Looking for advice on pursuing forensics..



User avatar


Posts: 5

Joined: Thu Oct 23, 2008 10:17 pm

Location: Southsea

Post Thu Oct 23, 2008 11:05 pm

Looking for advice on pursuing forensics..

Hi there,

I am a young university student studying Digital Forensics, with brief experience in computer security (RHCE, OSCP) & the ultimate end-game goal of working for a Law Enforcement Agency.

I wonder if the experience of this forum can help me...

In the long term, what are the steps involved in granting myself potential opportunities for my desired computer forensics career..?

Would I require work experience in the police force/military?
What is the importance of previous computer security placements in the eyes of a potential employer?
Is it mandatory to take numerous certifications? (EC-Council & CompTIA certs.. etc)
Is there an escalation process to obtain certain job roles (e.g. requirement of 5 years in XYZ)

The CFHI definitely has caught my attention for future study,
But until it is worthwhile for me to take the cert, are there any cheap/free resources that i can gain practical experience with? (in the field of computer forensics)

Like pre-canned file carving exercises & hypothetical crime scene scenarios.
(an equivalent example would be the course material of the OSCP or the learning platforms from www.foundstone.com)

While i realise this post drifts and is years ahead of me, i have many questions and a lot of passion. So i appreciate & look forward to your response(s)


*edit.. typos & grammar
Last edited by skitch on Fri Oct 24, 2008 1:07 am, edited 1 time in total.


User avatar


Posts: 28

Joined: Mon Apr 28, 2008 10:16 am

Post Sun Nov 16, 2008 10:34 am

Re: Looking for advice on pursuing forensics..

My general advice is to check out the Secret Service. Even consider joining an electronic crimes task force. Chicago has a good one if you are in the area, headed by the Secret Squirrels.


Make sure you get your B.S. degree and maybe go for your masters. Be a specialist in forensics, but don't forget "generalist" skills are critical (IT, business, law, etc). The Feds value solid certs like CISSP, CCNA, MCSE, etc.

Keep your record clean (no MIP, being in college  :P). Surprisingly the FBI and SS often recruit young people with degrees and skills because they can "mold" them and progress them through the agency. People coming from private industry often have a lot of baggage.
CISSP, Security+, CEH, OPP, et alii


User avatar


Posts: 210

Joined: Sat Nov 17, 2007 8:26 pm

Location: Detroit, Michigan

Post Sun Nov 16, 2008 2:32 pm

Re: Looking for advice on pursuing forensics..

Just my two cents, but really make a point to pick up the education and certs.  The main reason is that if you do manage to move into forensics there is a high probability that you'll end up having to testify.  The very first hurdle you have to get through is the validation of your background.  Having the degrees/certs helps that process quite a bit.  If you don't have those on your resume then you'll probably get challenged by the other legal team, and at that point they'll cook up all sorts of questions to try and show gaps in your knowledge or understanding of the tools and methods.  (So Mr. Coolforensicsguy, please tell me every difference between the ntfs and ext3 file systems, explain the md5 checksum algorithm in detail, and inform the court why your evidence should be permissible since you used Encase but are not certified)  The caveat to all of this is if you end up in a field where you do forensics for malware.  In that role you usually are more of an incident responder rather than investigations.


User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Mon Nov 17, 2008 5:45 pm

Re: Looking for advice on pursuing forensics..

I completely agree with ElCapitan, go for Fed employment.  Secret Service is one option, FBI, Customs, IRS, etc, are others.  A word of caution, you almost never get to be a forensics investigator from the start.  You have to go to Quantico first.  You then become a regular agent, eventually graduating to an investigator.  You can then request to be transferred into a forensics squad.  You will always remain an agent.  In case something major happens, you will be recalled.  You DO want to be an agent.  Agents get higher salary, better benefits, and first chance at juice assignments.  From what I have been told by ex-feds, agents look down on civilian employees.

Certifications are important.  For Federal Agents, the premier cert is CFCE, but it's only available to law enforcement.  For private sector, the cert of choice is CCE.  Interestingly enough, A+ certification still applies and is valued.  EnCE certification is also good.

I also agree that a BS degree is important.  Criminal justice, Information Security, Accounting degrees are highly sought after. 

If you live in a wealthy area, local police force may be an option.  Again, you are a cop first, then you become an investigator. 

Sounds like you are on the right track.  Stay in school and finish your BS degree.  Figure out what kind of investigation you want to concentrate on.  If you like accounting, IRS is good agency.  If you prefer criminal, FBI and Secret Service are great agencies.  Once you pass basic training, it's not unreasonable for you to be making six figures within 5 to 7 years, depending on your level ambition.  After that, the paygrades level out.  At this point, some Feds leave and enter the private sector.  There are few large forensics shops that snatch up Feds quickly.  They are great for gaining consulting experience, but they do not typically pay well.  Boutique shops pay better.  You have to do your research to make sure the shop is stable.  Beware of non-competes.

Anyway, those are my two cents.  I am probably rambling too much.  Who knows, maybe by the time you are done with school, EnCase 10.0 will have a single button, "Solve Case."  The main point is that you have to become an investigator.  Technical skills can be taught, by investigative skills are much more difficult to acquire.

Return to Forensics

Who is online

Users browsing this forum: No registered users and 1 guest

Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software